General

  • Target
    c0d461ef0985e5200de25a231d15845e.exe
  • Size 901KB
  • Sample210818-dmenb7g46n
  • SHA256 006dac8da13a28a8c98c6ec8ef112ee55544e0c4676cd2ffb393cb3cd66ebe15
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • gz92

C2
  • http://www.peggeorge.com/gz92/

Decoy
  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      c0d461ef0985e5200de25a231d15845e.exe
    • Size 901KB
    • SHA256 006dac8da13a28a8c98c6ec8ef112ee55544e0c4676cd2ffb393cb3cd66ebe15
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks